Firewalls Don't Stop Dragons Podcast

Password manager software maker LastPass suffered a data breach last week, which understandably made their customers very nervous – and caused some people to question the decision to put all their passwords in one digital basket. In today’s show, I’ll explain why this particular breach was not a threat to anyone’s passwords and why you should still use a high quality passwo...

Thirty years ago, a young hacker named Jeff Moss (aka The Dark Tangent) threw a party in the desert of Nevada to commemorate the demise of a bulletin board system called PlatinumNet. Unlike the other handful of hacker conferences in that time, this one would be on the West Coast and open to everyone. Over the next three decades, DEF CON would become the preeminent hacker convention for the US (pos...

If it’s August in Las Vegas, it’s time for Hacker Summer Camp. There are three hacker conferences that coordinate to happen next to each other every year: BSides Las Vegas, Black Hat and DEF CON. My first trip to DEF CON was last year and I was hooked – I hope to go back every year. This was the big 30th anniversary of DEF CON and several of the news stories this week came from o...

There’s no doubt that the internet has enabled criminals to share illicit and vile content with ease. The advent of high-quality end-to-end encrypted communications has made sharing this material harder for law enforcement to police. But the solution is not to cripple this technology, which is essential for security, privacy and even democracy. Today I’ll discuss this thorny issue with...

All software has bugs, so the more software you have installed, the more bugs you have. It’s not just the bugs in any individual application, but it’s also magnified by interactions between some applications. Thankfully, the converse is also true: the less software you have installed, the fewer bugs you have (statistically, anyway). How many apps have you installed because they were fr...

Cameras are everywhere. Every person you pass on the street has a camera on their phone and security cameras are everywhere. They’re so cheap and small now, and most of them are connected to the cloud. Not only does that mean they basically have unlimited storage, but it also opens the door for computers to process those images and footage looking for faces. Today, I’ll speak with Nate...

The “rolling code” technology used to remotely open and lock your car is supposed to prevent hacking. Unfortunately, Honda has a pretty serious vulnerability in their cars that apparently allows anyone with a little talent and cheap hacking tools to get into your car – and maybe even start it (though not actually drive it away). If correct, this vulnerability affects probably all...

We take that little box that connects our home to the internet for granted. But in reality, it’s often the only thing hiding our computers and vulnerable IoT devices from automated, remote attacks. This “internet background radiation” is ever present – a massive network of malicious or compromised devices, constantly scanning the internet for exposed and ill-protected syste...

This week we’ll talk about three significant new data breaches. Each of these data leaks are important in different ways, but the trend is clear: data wants to be free. First of all, we need to stop collecting so damn much of it. But second, we need to make it more expensive for data-collectors who are criminally negligent with the protection of our data. Right now, it’s cheaper to let...

While many of us prefer order in our lives, at least most of the time, we sometimes need a little chaos. Specifically, we need a source of true randomness in order to properly drive many of our cryptographic systems – to secure our digital communications, for example. And while computers are very good at doing what we tell them to do, they suck at being unpredictable. Therefore we have to fi...

Firefox officially rolled out its Total Cookie Protection feature last week, which is a clever and elegant solution for blocking tracking using third party cookies. Unfortunately… it doesn’t seem to be working for me when I tested it. There are at least a couple reasons for why this might be, and a workaround, both of which I will discuss in today’s Tip of the Week. Also: A drunk...

Everyone hates dealing with passwords, and yet they’ve been the de facto standard of computer authentication for decades. But there’s light at the end of this long tunnel. There is a passwordless future where we can log in to our accounts using just our smartphones. In this future, it won’t matter if websites are breached because there will be no password databases to steal. Even...

I preach about using password managers constantly – because they really are a fantastic tool for increasing your security. Humans suck at creating memorable passwords that are not also easy to guess. But the idea of putting all your juicy secrets into a digital vault that is controlled by a third party and synchronizing through the cloud may not sit well with you. And I totally get that. It&...

Everyone has heard of Bitcoin, but almost no one understands what the heck is actually is. Today I’m interviewing Seth from Seth for Privacy who knows cryptocurrency backwards and forwards. Seth is also a privacy advocate who understands the broader implications of digital currency. I’ll ask him to explain how cryptocurrency works, what the blockchain is, how crypto mining affects our...

Modern smartphones have a potentially life-saving feature called “SOS” or “Emergency” mode that can give first responders critical medical information and automatically dial your country’s emergency phone number. It can report your location and even notify selected contacts. In today’s show, I’ll share a story from one woman who believes this mode saved he...

There’s a lot we can glean from history but sometimes it’s not as obvious as you might think. For example, did you know that until the mid-1800’s, most of Americans hated tomatoes and that ketchup was originally made from mushrooms? The story behind how Americans came to love tomatoes is quite fascinating, but what is perhaps most interesting is the way our guest applies this kno...

When we surf the web today – on our computers or smartphones – we are mercilessly tracked. Marketing firms and data brokers are hoovering up ungodly amounts of our personal data, selling it, trading it and mining it to derive even more about us. Many offer some way to limit or stop this wanton data collection, but good luck figuring out how – let alone even knowing who to ask. Wo...

We are being tracked constantly by our cell phones. We willingly carry supercomputers in our pockets 24/7, and these devices are chock full of sensors and radios that are tattling on us. Sometimes on purpose, sometimes incidentally, and sometimes maliciously. Apps for brick and mortar stores are tracking you within their stores, noting where you go, how long you stay in some locations, and where y...

Security isn’t a big differentiator today when choosing a web browser. First of all, 3 of the top 5 browsers all use the same engine – Chrome, Edge and Opera are all based on Chromium. Second, there’s no real conflict of interest between browser makers and browser users when it comes to security – it’s a win-win situation. Also, most browsers today are plenty fast eno...

Google and Facebook will swear up and down that they do not sell your data. While technically true, they do sell access to your data. Basically, your data is private from everyone – but them. And that’s a crucial caveat. To have true privacy, you want to work with a company who has absolutely minimal access to your data. You want privacy by design. And this is not easy to do with a ver...

When people don’t understand how something works, it can be easy to be afraid of the consequences of that thing not working right. And this also makes them ripe targets for being frightened by hucksters who will then happily sell them a solution for the problem. This was the trade of snake oil salesmen back in the day – selling cures for ailments that didn’t exist or that didn&#8...

Today, most of us take the internet – and access to the internet – for granted. It’s ubiquitous. However, the current war in Ukraine has (hopefully) made us realize that things can change dramatically overnight. While we can always hope for the best, we should be at least minimally prepared for the worst. I’m not suggesting we all prepare for military invasion, but there ar...

I wrap up my de-Google project this week with two biggies: Google Drive and Google Docs. I decided to reduce my Google data footprint as one of my 2022 New Year’s resolutions, so I’ve done a ton of research to replace all the major Google services with privacy-respecting alternatives. My hope is that you can use this information to reduce your own Google data exposure (and help your fr...

Today I’m speaking with a fellow privacy evangelist: Henry from Techlore. Like me, Henry and his team are on a mission to teach regular, everyday people how to secure their data and improve their privacy. Henry and I have a frank discussion about the importance of privacy today and the struggles we have when deciding which privacy-oriented products to recommend. First of all, everyone’...

One of my New Year’s resolutions for 2022 is to reduce my Google footprint – to try to de-Google my life as best I can – and hopefully inspire you to do the same. In today’s show, I’ll talk about replacing Google’s many communications apps (Meet, Hangouts, Chat, Talk), Google Authenticator (the Kleenex of 2FA apps), Google Maps and Waze, and YouTube. In security...